VulnSocial

CVE-2026-45257Disclosure(freebsd / freebsd)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch freebsd freebsd systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data. An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.

freebsd CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-123

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • freebsd

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 9 mentions across 7 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 7 signals
  • Disclosure: 4 classified signals
  • General: 2 classified signals
  • Peaked 5d ago at 3 mentions (2026-06-12); latest day: 1
  • 9 total mentions across 7 days

Affected systems

Vendors
freebsd
Products
freebsd

4 versions affected across 1 product

Deep dive

Activity timeline9 mentions / 7d
01223Mentions · 2026-06-10: 1Mentions · 2026-06-12: 3Mentions · 2026-06-13: 1Mentions · 2026-06-18: 1Mentions · 2026-06-22: 1Mentions · 2026-06-26: 1Mentions · 2026-06-27: 1PoC Mentioned / Linked · 2026-06-12: 1PoC Mentioned / Linked · 2026-06-18: 1PoC Mentioned / Linked · 2026-06-22: 1Exploit Tool / Code · 2026-06-22: 1Patch / Workaround · 2026-06-12: 1Patch / Workaround · 2026-06-13: 1Patch / Workaround · 2026-06-22: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-12: 2Technical Details · 2026-06-13: 1Technical Details · 2026-06-18: 1Technical Details · 2026-06-22: 1Technical Details · 2026-06-27: 106-1006-1206-1306-1806-2206-2606-27
Signal classification5 categories
Disclosure
444.4%
General
222.2%
Patch
111.1%
Exploit
111.1%
PoC
111.1%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-06-101
Disclosure1
2026-06-123
Disclosure2General1
2026-06-131
Patch1
2026-06-181
Exploit1
2026-06-221
PoC1
2026-06-261
General1
2026-06-271
Disclosure1
Full discourse9 posts
  • Florian Roth ⚡️@cyb3rops
    Disclosure

    CVE-2026-45257 / FreeBSD-SA-26:26.ktls Local file overwrite on FreeBSD. A local user can overwrite files they can read. Turn that into a SUID overwrite and you get root. But it is still a LPE, not a direct remote unauthenticated bug. The realistic risk is post-exploitation: - get code execution in some service first - then use this to become root Also, "patch now" is not always simple with FreeBSD. A lot of FreeBSD is hidden in appliances, firewalls, storage systems, network devices, vendor images, and embedded-ish setups. Those are often outside normal server patch management. I also heard mixed reports from people trying to reproduce the public PoC on unpatched systems https://seclists.org/oss-sec/2026/q2/881 https://bumsrake.de/

    Post summary

    CVE‑2026‑45257 is a local file overwrite flaw in FreeBSD that can lead to privilege escalation; a public PoC exists and patching is complicated on embedded appliances, but no active exploitation has been reported.

    0402414.7K
    222.2K followersView on X
  • Anderson Nascimento@andersonc0d3
    Disclosure

    CVE-2026-45257: FreeBSD kTLS-RX in-place AES-GCM decrypt over sendfile(2) EXTPG mbufs to page-cache write / local root https://seclists.org/oss-sec/2026/q2/881

    Post summary

    The statement announces CVE‑2026‑45257, a local‑root vulnerability in FreeBSD kTLS‑RX involving an AES‑GCM decrypt flaw over sendfile(2), with a link to a discussion thread for further details.

    120961.5K
    4.2K followersView on X
  • Daily CyberSecurity@the_yellow_fall
    PoC

    A public PoC exploit for the FreeBSD kTLS vulnerability (CVE-2026-45257) enables local privilege escalation to root. Patch your FreeBSD systems now. #FreeBSD #kTLS #CVE202645257 #PrivilegeEscalation #LocalRoot #PoC #KernelSecurity https://securityonline.info/freebsd-ktls-cve-2026-45257 https://t.co/ncc5RyKQOH

    Post summary

    A public PoC for CVE-2026-45257 in FreeBSD's kTLS enables local privilege escalation; users are urged to patch their systems.

    030861.2K
    12.8K followersView on X
  • Open Source Security mailing list@oss_security
    Exploit

    CVE-2026-45257,FreeBSD-SA-26:26.kTLS: FreeBSD kTLS-RX in-place AES-GCM decrypt over sendfile(2) EXTPG mbufs to page-cache write / local root https://www.openwall.com/lists/oss-security/2026/06/10/20 Analogue of Linux's Dirty Pipe, introduced around 2020 and first shipped in 13.0 (April 2021). Exploit attached.

    Post summary

    CVE‑2026‑45257 is a FreeBSD kTLS‑RX AES‑GCM decryption flaw akin to Linux Dirty Pipe, with an exploit code attached, but no evidence of active, wild exploitation or available patch.

    02051721
    4.7K followersView on X
  • Autumn Good@autumn_good_35
    Disclosure

    『It is the FreeBSD analogue of Linux's Dirty Pipe.』 CVE-2026-45257: FreeBSD kTLS-RX in-place AES-GCM decrypt over sendfile(2) EXTPG mbufs to page-cache write / local root https://seclists.org/oss-sec/2026/q2/881

    Post summary

    The text announces a new FreeBSD vulnerability (CVE-2026-45257) analogous to Linux Dirty Pipe, describing a local privilege escalation via kTLS-RX AES‑GCM decrypt over sendfile, but provides no PoC, exploit, or patch information.

    00021383
    6.9K followersView on X
  • VulDB 🛡@vuldb
    General

    There is a new vulnerability with elevated criticality in FreeBSD (CVE-2026-45257) https://vuldb.com/vuln/374166

    Post summary

    The entry announces a new, high‑severity vulnerability in FreeBSD (CVE-2026-45257) but provides no additional technical details, PoC, patch information, or exploitation evidence.

    00010158
    2.2K followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH: CVE-2026-45257 (CVSS 7.8) FreeBSD KTLS flaw allows unprivileged local users to overwrite file contents & escalate privileges by exploiting in-place decryption of file-backed memory over loopback connections. #CVE #Vulnerability #PatchNow https://t.co/CmXZOaxeTW

    Post summary

    The tweet announces the discovery of CVE-2026-45257, a high‑severity FreeBSD KTLS flaw that allows local privilege escalation.

    0000058
    52 followersView on X
  • foursignals@foursignalsdev
    Patch

    CVE-2026-45257: LPE in FreeBSD's kTLS-RX subsystem. Patch immediately if using TLS offloading in production. https://www.foursignals.dev/wire/2026-06-12/cve-2026-45257-lpe-in-freebsd-via-ktls-rx-e879ef

    Post summary

    An LPE vulnerability in FreeBSD’s kTLS‑RX subsystem is disclosed, with an urgent patch recommendation for TLS offloading users.

    0000031
    13 followersView on X
  • Imad Soltani@ximad
    General

    CVE-2026-45257 / https://bumsrake.de <-- hahaha :)

    Post summary

    The excerpt casually references CVE-2026-45257 with a hyperlink, but offers no substantive information about the vulnerability, exploitation, or mitigation.

    0000044
    3.3K followersView on X
CPE platform detail33 entries

33 of 33 entries

PartVendorProductVersionTarget SWTarget HW
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.1--

Explore more

Back to dashboardfreebsd CVEsfreebsd vulnerabilities